I think this is solvable by educating devs, not just by enforcing policies. And path to production should be a well defined process, that has to evolve from collaboration between devs and ops, so nobody should be able to just "hack production" on their own, and ops could also be doing dev code reviews to see what exactly they are doing.